fix: list one authorized document per project across turns

[time-attack]

Fixes #601. Reported by @ianTPE from a multi-user QM deployment.

A project's Files view was displaying the artifact ledger: each upload or agent reattachment created another row for the same document. Keep that ledger, but return one authorized document per scope/content hash in the viewer's file list.

Change

• Combine owned artifacts and exact ACL-granted artifacts, apply visibility/name/scope filters, then group before cursor pagination.
• Prefer an owned copy when present, then the earliest artifact with a deterministic ID tie-break. Unknown hashes stay separate.
• Keep raw artifact listing, original IDs/paths, downloads, grants, attribution, and stored bytes unchanged. No migration, dependency, speculative index, or new UI.
• Drain pages for the unpaginated context-resources response.
• Keep search on raw authorized artifact identities. Per-viewer document representatives must not change cross-principal file-ID intersection or truncate previously-searchable shared files.

Validation

• The multi-contributor regression failed before the fix: the combined file page exceeded its limit and repeated documents.
• Final affected file/permission/API/search suites: 105 passed, no failures/skips.
• Real PostgreSQL 16 artifact-store suite: 10 passed, no failures/skips. The same document-listing contract runs against memory and PostgreSQL.
• Covers multi-contributor echoes, owned/shared overlap across pages, later duplicate inserts, scope isolation, disabled grants, name filters, null hashes, deterministic ties, original download handles, 55/55/110-document context listings, and search beyond 200 shared files.
• Typecheck, full ESLint, Oxlint, formatting, and Knip passed.
• Two independent review passes accepted the final patch after the context-pagination and exact-search-identity regressions were corrected.

Local behavior check

Booted the real core with a synthetic four-document dataset and exercised GET /v1/scope-resources before and after:

	Before	After
Listed artifact/document rows	10	4
Unique documents preserved	4	4

No production data, credentials, or LLM calls were used for this check.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}